Exam Security-Operations-Engineer Topic 3 Question 49 Discussion

Actual exam question for Google's Security-Operations-Engineer exam
Question #: 49
Topic #: 3
You are an incident response engineer at an organization that uses Google Security Operations (SecOps). You recently started monitoring IOCs in Applied Threat Intelligence using YARA-L rules. You have discovered that there are more false positive alerts than expected, which is causing noise for the SOC team. You need to reduce the number of false positive alerts. What should you do?

Suggested Answer: A Vote an answer

To reduce false positives in YARA-L rules that use Applied Threat Intelligence, you should modify the rules to only trigger on indicators with an IC-Score of 60% or higher. The Indicator Confidence Score (IC-Score) reflects the reliability of each IOC; filtering by a higher score reduces noise from low-confidence indicators while maintaining detection of credible threats.

by Polly at Jul 07, 2026, 10:47 PM

Limited Time Offer

15%

Off

Get Premium Security-Operations-Engineer Questions as Interactive Self Test Engine or PDF

Comments

Chosen Answer:
This is a voting comment (?) , you can switch to a simple comment.
Switch to a voting comment New
Nick name: Submit Cancel
A voting comment increases the vote count for the chosen answer by one.

Upvoting a comment with a selected answer will also increase the vote count towards that answer by one. So if you see a comment that you already agree with, you can upvote it instead of posting a new comment.
0
0
0
10